The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted, unstructured data from external systems which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: The skill ingests data from git history, GitHub Pull Request bodies and comments (gh pr view), Linear tickets, Notion documents, Slack messages, and Sentry error events as defined in the Step 3 discovery process in SKILL.md and the playbook files in references/sources/.
Boundary markers: The investigator and synthesizer prompt templates (references/investigator-prompt.md, references/synthesizer-prompt.md) do not include explicit delimiters or instructions to treat external data as untrusted content, increasing the risk of the agent obeying instructions embedded within the data.
Capability inventory: Subagents are configured with readonly: false in SKILL.md to allow for tool-based evidence gathering, which gives them access to MCP tools and shell commands like git, gh, and rg while processing potentially malicious data.
Sanitization: There is no evidence of sanitization, filtering, or escaping of the external content before it is processed by the investigator or synthesizer agents.
[COMMAND_EXECUTION]: The skill executes shell commands to extract information from the local repository and linked services.
Evidence: SKILL.md uses git blame, git log, and gh pr view to establish context. The playbook in references/sources/code-archaeology.md utilizes git log -S, git show, and rg for historical analysis.

why